topic graphing cumulative counters in Splunk Search

graphing cumulative counters

charleswheelus — Fri, 20 Apr 2012 18:38:15 GMT

I have several counters reported to splunk which continually increment over time and are rarely if ever reset. I would like to be able to graphs the deltas between each counter over a period of time.

For instance, lets call one of the counters "LOGINS". Over time LOGINS will continue to accumulate every time a user logs in. I would like to be able to display a graph of the number of logins per hour over each day, and NOT each subsequently larger number of logins. Which means that while my data looks like that data in the first graph, what I want to display is the second graph. (See below)

Can someone explain how this can be accomplished?

Cumulative - How my data actually exists in splunk

Non Cumulative - what I want to display

Re: graphing cumulative counters

cphair — Fri, 20 Apr 2012 19:04:54 GMT

Use the delta command: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Delta

It is applied in the order of events (that is, newest to oldest), so you will see negative deltas on an accumulated field, but you should be able to work out the graph you want from that data.

Re: graphing cumulative counters

charleswheelus — Mon, 30 Apr 2012 16:20:14 GMT

The delta command did work. I had to use the reverse command to get the chart ordered the way I wanted it. In the context of this problem the syntax I used was:

LOGINS | reverse | table LOGINS | delta LOGINS AS logindelta

I then selected the chart icon in the results tab.